Ireland: Data Protection Commission (DPC) launches investigation and issues draft decision on Facebook's EU-US data transfers

On 28 August 2020, the Irish Data Protection Commission (DPC) launched a statutory investigation into the legality of Facebook Ireland's data transfers to the US, along with issuing a preliminary draft decision ordering Facebook to suspend its data transfers. The DPC highlighted concerns regarding EU individuals' lack of privacy rights when their personal data is moved to the US for commercial purposes and regarding the standard contractual clauses (SCCs) used by Facebook. The investigation is carried out under the Data Protection Act of 2018, as well as pertinent GDPR regulations and comes as a continuation of the CJEU's "Schrems II" judgment invalidating the EU-US Privacy Shield, issued on 16 July 2020. The DPC granted Facebook 21 days to respond and noted during the court hearing that "a reasoned request for further time" would be considered. The DPC also declared that it aimed to formalise its "draft decision" to submit to the GDPR Article 60 procedure within 21 days of receiving Facebook's submission.